← All changes | back/Controllers/Users/Subscription.php +14 -0 10.11.1 → 11.1.0 View file →

		@@ -7,8 +7,10 @@
7	7	trait Subscription
8	8	{
9	9	public function resetSubscription(): void
10	10	{
	11	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
	12	+
11	13	$userId = acym_getVar('int', 'userId');
12	14
13	15	if (empty($userId)) {
14	16	$this->listing();
		@@ -31,8 +33,10 @@
31	33	}
32	34
33	35	public function unsubscribeUser(): void
34	36	{
	37	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
	38	+
35	39	$userId = acym_getVar('int', 'userId');
36	40	if (empty($userId)) {
37	41	$this->listing();
38	42
		@@ -54,8 +58,10 @@
54	58	}
55	59
56	60	public function unsubscribeUserFromAll(): void
57	61	{
	62	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
	63	+
58	64	$userId = acym_getVar('int', 'userId');
59	65
60	66	if (empty($userId)) {
61	67	$this->listing();
		@@ -82,8 +88,10 @@
82	88	}
83	89
84	90	public function resubscribeUserToAll(): void
85	91	{
	92	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
	93	+
86	94	$userId = acym_getVar('int', 'userId');
87	95	if (empty($userId)) {
88	96	$this->listing();
89	97
		@@ -109,8 +117,13 @@
109	117	}
110	118
111	119	public function subscribeUser(bool $returnOnEdit = true, array $lists = [], bool $frontCreation = false): void
112	120	{
	121	+ // Called as a task (no argument) → require a CSRF token. Internal calls from apply() are already token-checked.
	122	+ if (func_num_args() === 0) {
	123	+ wp_verify_nonce(acym_getVar('cmd', '_wpnonce'), 'acymnonce') || die('Invalid Token');
	124	+ }
	125	+
113	126	$userId = acym_getVar('int', 'userId');
114	127	if (empty($userId)) {
115	128	$this->listing();
116	129
		@@ -121,8 +134,9 @@
121	134	if (!$frontCreation && !$userClass->hasUserAccess($userId)) {
122	135	die('Access denied for subscribing this user');
123	136	}
124	137
	138	+ // Can be called from the user's edition page when re-subscribing to a list
125	139	if (empty($lists)) {
126	140	$lists = json_decode(acym_getVar('string', 'acym__entity_select__selected', '[]'), true);
127	141	if (empty($lists)) {
128	142	$lists = [];